Vulnerability · Published Feb 10, 2026 · Assigned by sap

CVE-2026-23685Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)

Medium 4.4

In plain English

A medium-severity unsafe deserialization in SAP NetWeaver (JMS service) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 4% of all known vulnerabilities).

Severity (CVSS 3.1)4.4Medium

Exploit odds (30 days)0.2%top 95.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Due to a Deserialization vulnerability in SAP NetWeaver (JMS service), an attacker authenticated as an administrator with local access could submit specially crafted content to the server. If processed by the application, this content could trigger unintended behavior during internal logic execution, potentially causing a denial of service. Successful exploitation results in a high impact on availability, while confidentiality and integrity remain unaffected.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP NetWeaver (JMS service)	J2EE-FRMW 7.50

Weakness: CWE-502 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

In plain English

Official description

Affected products (as reported)

References